diff --git a/.envrc b/.envrc
new file mode 100644
index 0000000..a4fcb30
--- /dev/null
+++ b/.envrc
@@ -0,0 +1,2 @@
+dotenv_if_exists
+use flake
diff --git a/.gitignore b/.gitignore
index fcfc4a1..64b8a9d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,3 @@
+.env
+.direnv
 result*
diff --git a/build.nix b/build.nix
new file mode 100644
index 0000000..2ebfea3
--- /dev/null
+++ b/build.nix
@@ -0,0 +1,120 @@
+{ pkgs, stdenv, pkgsCross, fetchurl, unzip, writeTextDir }:
+with stdenv;
+let
+  configDir = "/var/lib/ngrok";
+  releases = builtins.fromJSON (builtins.readFile ./releases.json);
+  version = releases.version;
+  ngrokDrv = { sha256, url }:
+    stdenv.mkDerivation {
+      name = "ngrok-${version}";
+      version = version;
+      src = fetchurl { inherit sha256 url; };
+      sourceRoot = ".";
+      unpackPhase = "${unzip}/bin/unzip $src ngrok";
+      buildPhase = "chmod a+x ngrok";
+      installPhase = ''
+        install -D ngrok $out/bin/ngrok
+      '';
+    };
+  ngrokBinArm = ngrokDrv releases.arm;
+  ngrokBinAmd64 = ngrokDrv releases.amd64;
+  ngrokBinArm64 = ngrokDrv releases.arm64;
+  ngrokBini386 = ngrokDrv releases.i386;
+  shadowSetup = [
+    (writeTextDir "etc/shadow" ''
+      root:!x:::::::
+      ngrok:!:::::::
+    '')
+    (writeTextDir "etc/passwd" ''
+      root:x:0:0::/root:/bin/bash
+      ngrok:x:1000:100::/home/ngrok:
+    '')
+    (writeTextDir "etc/group" ''
+      root:x:0:
+      ngrok:x:100:
+    '')
+    (writeTextDir "etc/gshadow" ''
+      root:x::
+      ngrok:x::
+    '')
+  ];
+  entrypoint = ./scripts;
+  extraCommands = ''
+    mkdir -p .${configDir}
+    chmod a+rw -R .${configDir}
+    echo "version: 2" > .${configDir}/ngrok.yml
+    echo "web_addr: 0.0.0.0:4040" >> .${configDir}/ngrok.yml
+  '';
+in
+rec {
+  debianArm64 = import ./debian.nix {
+    ngrokBin = ngrokBinArm64;
+    arch = "arm64";
+    pkgs = pkgsCross.aarch64-multiplatform;
+    imageSha256 = "0n2i0862bahqdwwxf1gypvlrzrl8cdmph6h76r45awh1lcxn650f";
+    imageDigest =
+      "sha256:eb9b613b4f63193f4476e62af4cb5bff5e3ba0683c4c7f317b2a2c7e3ec22ee6";
+    inherit extraCommands entrypoint shadowSetup version;
+  };
+  alpineArm64 = import ./alpine.nix {
+    ngrokBin = ngrokBinArm64;
+    arch = "arm64";
+    pkgs = pkgsCross.aarch64-multiplatform;
+    imageSha256 = "13h5sh8fnxyaw7n69h7865ybda6lr7vhagf5fgxwjm8yr1pxf3li";
+    imageDigest =
+      "sha256:53b74ddfc6225e3c8cc84d7985d0f34666e4e8b0b6892a9b2ad1f7516bc21b54";
+    inherit extraCommands entrypoint shadowSetup version;
+  };
+  debianAmd64 = import ./debian.nix {
+    ngrokBin = ngrokBinAmd64;
+    arch = "amd64";
+    imageSha256 = "1rqvk4zhxx7xi5gqzwdz5f36s40avan4fbimkfbvg2jq8i0jqnd5";
+    imageDigest =
+      "sha256:5625c115ad881f19967a9b66416f8d40710bb307ad607d037f8ad8289260f75f";
+    inherit pkgs extraCommands entrypoint shadowSetup version;
+  };
+  alpineAmd64 = import ./alpine.nix {
+    ngrokBin = ngrokBinAmd64;
+    arch = "amd64";
+    imageDigest =
+      "sha256:1775bebec23e1f3ce486989bfc9ff3c4e951690df84aa9f926497d82f2ffca9d";
+    imageSha256 = "1jjqqp6vkmmy1i37dk0z3slsdbjahy9shsm7vhhrk07kgx8ia7xs";
+    inherit pkgs extraCommands entrypoint shadowSetup version;
+  };
+  debianArm = import ./debian.nix {
+    ngrokBin = ngrokBinArm;
+    arch = "arm";
+    pkgs = pkgsCross.armv7l-hf-multiplatform;
+    imageSha256 = "0hxqdcwnkv55l56jgg1iqk9lhgnz43v4kqbycnb3zhjvkkjk6b51";
+    imageDigest =
+      "sha256:32c2874ad59bf7908d2a9f7b25409b17cd2927e852d46ed91acfcca4fb64590f";
+    inherit extraCommands entrypoint shadowSetup version;
+  };
+  alpineArm = import ./alpine.nix {
+    ngrokBin = ngrokBinArm;
+    arch = "arm";
+    pkgs = pkgsCross.armv7l-hf-multiplatform;
+    imageSha256 = "1idf4x6dk290wm731yjpf2swyrlajbdd9bg3z7vvsrrzz2gsdgjn";
+    imageDigest =
+      "sha256:8d99168167baa6a6a0d7851b9684625df9c1455116a9601835c2127df2aaa2f5";
+    inherit extraCommands entrypoint shadowSetup version;
+  };
+  debian386 = import ./debian.nix {
+    ngrokBin = ngrokBini386;
+    arch = "i386";
+    pkgs = pkgsCross.gnu32;
+    imageSha256 = "19fcclfrd6wpdxkxccfg23f7zvaqm4sdd9vyfv9fssi4662809ps";
+    imageDigest =
+      "sha256:8aa52e36d688dfaf6a949884cecc0aa5bd0bc92a626b11c2feeb8a23fbcf3190";
+    inherit extraCommands entrypoint shadowSetup version;
+  };
+  alpine386 = import ./alpine.nix {
+    ngrokBin = ngrokBini386;
+    arch = "i386";
+    pkgs = pkgsCross.gnu32;
+    imageSha256 = "07lapaqi63rz58fxhp13h673aj3mpsxkl0mhb4hxprkpg58hfgh0";
+    imageDigest =
+      "sha256:52a197664c8ed0b4be6d3b8372f1d21f3204822ba432583644c9ce07f7d6448f";
+    inherit extraCommands entrypoint shadowSetup version;
+  };
+}
diff --git a/default.nix b/default.nix
index 2661199..3f0511e 100644
--- a/default.nix
+++ b/default.nix
@@ -1,119 +1,13 @@
-with import (import ./pkgs.nix) { };
-with stdenv;
-let
-  configDir = "/var/lib/ngrok";
-  releases = builtins.fromJSON (builtins.readFile ./releases.json);
-  version = releases.version;
-  ngrokDrv = { sha256, url }:
-    stdenv.mkDerivation {
-      name = "ngrok-${version}";
-      version = version;
-      src = fetchurl { inherit sha256 url; };
-      sourceRoot = ".";
-      unpackPhase = "${pkgs.unzip}/bin/unzip $src ngrok";
-      buildPhase = "chmod a+x ngrok";
-      installPhase = ''
-        install -D ngrok $out/bin/ngrok
-      '';
-    };
-  ngrokBinArm = ngrokDrv releases.arm;
-  ngrokBinAmd64 = ngrokDrv releases.amd64;
-  ngrokBinArm64 = ngrokDrv releases.arm64;
-  ngrokBini386 = ngrokDrv releases.i386;
-  shadowSetup = with pkgs; [
-    (writeTextDir "etc/shadow" ''
-      root:!x:::::::
-      ngrok:!:::::::
-    '')
-    (writeTextDir "etc/passwd" ''
-      root:x:0:0::/root:/bin/bash
-      ngrok:x:1000:100::/home/ngrok:
-    '')
-    (writeTextDir "etc/group" ''
-      root:x:0:
-      ngrok:x:100:
-    '')
-    (writeTextDir "etc/gshadow" ''
-      root:x::
-      ngrok:x::
-    '')
-  ];
-  entrypoint = ./scripts;
-  extraCommands = ''
-    mkdir -p .${configDir}
-    chmod a+rw -R .${configDir}
-    echo "version: 2" > .${configDir}/ngrok.yml
-    echo "web_addr: 0.0.0.0:4040" >> .${configDir}/ngrok.yml
-  '';
-in {
-  debianArm64 = import ./debian.nix {
-    ngrokBin = ngrokBinArm64;
-    arch = "arm64";
-    pkgs = pkgsCross.aarch64-multiplatform;
-    imageSha256 = "0n2i0862bahqdwwxf1gypvlrzrl8cdmph6h76r45awh1lcxn650f";
-    imageDigest =
-      "sha256:eb9b613b4f63193f4476e62af4cb5bff5e3ba0683c4c7f317b2a2c7e3ec22ee6";
-    inherit extraCommands entrypoint shadowSetup version;
-  };
-  alpineArm64 = import ./alpine.nix {
-    ngrokBin = ngrokBinArm64;
-    arch = "arm64";
-    pkgs = pkgsCross.aarch64-multiplatform;
-    imageSha256 = "13h5sh8fnxyaw7n69h7865ybda6lr7vhagf5fgxwjm8yr1pxf3li";
-    imageDigest =
-      "sha256:53b74ddfc6225e3c8cc84d7985d0f34666e4e8b0b6892a9b2ad1f7516bc21b54";
-    inherit extraCommands entrypoint shadowSetup version;
-  };
-  debianAmd64 = import ./debian.nix {
-    ngrokBin = ngrokBinAmd64;
-    arch = "amd64";
-    imageSha256 = "1rqvk4zhxx7xi5gqzwdz5f36s40avan4fbimkfbvg2jq8i0jqnd5";
-    imageDigest =
-      "sha256:5625c115ad881f19967a9b66416f8d40710bb307ad607d037f8ad8289260f75f";
-    inherit pkgs extraCommands entrypoint shadowSetup version;
-  };
-  alpineAmd64 = import ./alpine.nix {
-    ngrokBin = ngrokBinAmd64;
-    arch = "amd64";
-    imageDigest =
-      "sha256:1775bebec23e1f3ce486989bfc9ff3c4e951690df84aa9f926497d82f2ffca9d";
-    imageSha256 = "1jjqqp6vkmmy1i37dk0z3slsdbjahy9shsm7vhhrk07kgx8ia7xs";
-    inherit pkgs extraCommands entrypoint shadowSetup version;
-  };
-  debianArm = import ./debian.nix {
-    ngrokBin = ngrokBinArm;
-    arch = "arm";
-    pkgs = pkgsCross.armv7l-hf-multiplatform;
-    imageSha256 = "0hxqdcwnkv55l56jgg1iqk9lhgnz43v4kqbycnb3zhjvkkjk6b51";
-    imageDigest =
-      "sha256:32c2874ad59bf7908d2a9f7b25409b17cd2927e852d46ed91acfcca4fb64590f";
-    inherit extraCommands entrypoint shadowSetup version;
-  };
-  alpineArm = import ./alpine.nix {
-    ngrokBin = ngrokBinArm;
-    arch = "arm";
-    pkgs = pkgsCross.armv7l-hf-multiplatform;
-    imageSha256 = "1idf4x6dk290wm731yjpf2swyrlajbdd9bg3z7vvsrrzz2gsdgjn";
-    imageDigest =
-      "sha256:8d99168167baa6a6a0d7851b9684625df9c1455116a9601835c2127df2aaa2f5";
-    inherit extraCommands entrypoint shadowSetup version;
-  };
-  debian386 = import ./debian.nix {
-    ngrokBin = ngrokBini386;
-    arch = "i386";
-    pkgs = pkgsCross.gnu32;
-    imageSha256 = "19fcclfrd6wpdxkxccfg23f7zvaqm4sdd9vyfv9fssi4662809ps";
-    imageDigest =
-      "sha256:8aa52e36d688dfaf6a949884cecc0aa5bd0bc92a626b11c2feeb8a23fbcf3190";
-    inherit extraCommands entrypoint shadowSetup version;
-  };
-  alpine386 = import ./alpine.nix {
-    ngrokBin = ngrokBini386;
-    arch = "i386";
-    pkgs = pkgsCross.gnu32;
-    imageSha256 = "07lapaqi63rz58fxhp13h673aj3mpsxkl0mhb4hxprkpg58hfgh0";
-    imageDigest =
-      "sha256:52a197664c8ed0b4be6d3b8372f1d21f3204822ba432583644c9ce07f7d6448f";
-    inherit extraCommands entrypoint shadowSetup version;
-  };
-}
+(import
+  (
+    let
+      lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+    in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  {
+    src = ./.;
+  }).defaultNix.packages.x86_64-linux
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..10d21a0
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,78 @@
+{
+  "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1709703039,
+        "narHash": "sha256-6hqgQ8OK6gsMu1VtcGKBxKQInRLHtzulDo9Z5jxHEFY=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "9df3e30ce24fd28c7b3e2de0d986769db5d6225d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..8dbe962
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,23 @@
+{
+  description = "The ngrok docker container";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    flake-compat = {
+      url = "github:edolstra/flake-compat";
+      flake = false;
+    };
+  };
+
+  outputs = { self, nixpkgs, flake-utils, ... }:
+    let
+      pkgs = import nixpkgs {
+        system = "x86_64-linux";
+      };
+    in
+    {
+      packages.x86_64-linux = pkgs.callPackage ./build.nix { };
+      devShells.x86_64-linux.default = pkgs.mkShell { };
+    };
+}
diff --git a/pkgs.nix b/pkgs.nix
deleted file mode 100644
index 016cb6a..0000000
--- a/pkgs.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-let
-  # Follow from http://hydra.nixos.org/job/nixpkgs/trunk/unstable through a
-  # passing hydra build and nab the commit from that.
-  # This ensures the upstream nix cache has all artifacts for this commit.
-  commit = "a916ffbb2752be32b1d44cf40bed4dbc1974da62";
-  url = "https://github.com/NixOS/nixpkgs/archive/${commit}.tar.gz";
-in builtins.fetchTarball {
-  inherit url;
-
-  sha256 = "1xn3lqiyp1x1qq9kb7prqzbdy2brabspsyh7j8x6srj4600gif5l";
-}